TOTP / 2FA Code Generator

What Is a TOTP / 2FA Code Generator?

// Generate a TOTP code in the browser with the Web Crypto API
// (SHA-1, 6 digits, 30s period — RFC 6238 defaults)
async function generateTotp(base32Secret, time = Date.now()) {
  // Decode the Base32 secret to raw bytes (A-Z, 2-7)
  const alpha = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
  let bits = '';
  for (const c of base32Secret.replace(/=+$/, '').toUpperCase())
    bits += alpha.indexOf(c).toString(2).padStart(5, '0');
  const bytes = new Uint8Array(
    bits.match(/.{8}/g).map((b) => parseInt(b, 2)));

  // Counter = number of 30s steps since the Unix epoch (8-byte big-endian)
  const counter = Math.floor(time / 1000 / 30);
  const msg = new Uint8Array(8);
  let c = counter;
  for (let i = 7; i >= 0; i--) { msg[i] = c & 0xff; c = Math.floor(c / 256); }

  const key = await crypto.subtle.importKey(
    'raw', bytes, { name: 'HMAC', hash: 'SHA-1' }, false, ['sign']);
  const hmac = new Uint8Array(await crypto.subtle.sign('HMAC', key, msg));

  // Dynamic truncation (RFC 4226) -> 6-digit code
  const off = hmac[hmac.length - 1] & 0x0f;
  const bin = ((hmac[off] & 0x7f) << 24) | (hmac[off + 1] << 16) |
              (hmac[off + 2] << 8) | hmac[off + 3];
  return (bin % 1_000_000).toString().padStart(6, '0');
}

const code = await generateTotp('JBSWY3DPEHPK3PXP');
// -> a 6-digit code that rotates every 30 seconds

Key Features

TOTP Generator Examples

secret: JBSWY3DPEHPK3PXP
algorithm: SHA-1
digits: 6
period: 30s

Code: 282760  ·  expires in 30s

secret: JBSWY3DPEHPK3PXP
algorithm: SHA-256
digits: 8
period: 30s

Code: 31094217  ·  expires in 30s

issuer: Acme
account: alice@example.com
secret: JBSWY3DPEHPK3PXP

otpauth://totp/Acme:alice@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Acme&algorithm=SHA1&digits=6&period=30

How to Use the TOTP Generator

1. 1

   Paste a Base32 Secret

   On the Generate tab, paste your Base32 secret (for example JBSWY3DPEHPK3PXP). The current TOTP code appears instantly with a 30-second countdown — no Generate button.

2. 2

   Adjust Advanced Options (optional)

   Open advanced options to change the algorithm (SHA-1/256/512), digit count (6 or 8), or period (30 or 60s) to match what your provider issued.

3. 3

   Set Up or Verify

   Use the Set up tab to generate a secret and QR for an authenticator app, or the Verify tab to check a code against a secret with ±1 time-step tolerance.

Common Mistakes

secret + SHA-1/6 digits  // but server expects SHA-256/8

algorithm: SHA-256, digits: 8  // match the otpauth:// URI

system clock 90s fast  // code is two steps ahead

enable NTP / automatic time  // code aligns with server

secret: "JBSW 0NE8"  // contains 0 and 8

secret: "JBSWY3DPEHPK3PXP"  // valid Base32

Common Use Cases

Debug a 2FA Login Flow

Reproduce the exact code a user's authenticator app shows, so you can trace why a two-factor sign-in is being rejected.

Enroll a New Account

Generate a fresh Base32 secret and QR code, then scan it into Google Authenticator, Authy, or 1Password to set up 2FA.

Validate Your Server's Window

Verify codes against a secret to confirm your backend accepts a code that just rotated and rejects an expired one.

Build End-to-End Test Fixtures

Compute deterministic TOTP codes from a known secret to drive automated tests of a two-factor authentication flow.

Match Enterprise Settings

Reproduce 8-digit or SHA-256 codes when a provider departs from the SHA-1 / 6-digit defaults, to debug a mismatch.

Recover Access Quickly

Generate the current code from a backed-up secret when your phone is unavailable — using a disposable copy of the secret.

Technical Details

RFC 6238 / RFC 4226 Compliant

Implements TOTP per RFC 6238 on top of the HOTP dynamic-truncation algorithm from RFC 4226, with selectable SHA-1, SHA-256, and SHA-512.

Native Web Crypto HMAC

Codes are derived via crypto.subtle HMAC over the big-endian time-step counter. Base32 decoding and truncation run entirely in-browser.

Standard otpauth:// URIs, Zero Dependencies

Setup URIs follow the Key Uri Format (otpauth://totp) with issuer, algorithm, digits, and period parameters. No external libraries, no network calls.

Best Practices

Treat the Secret Like a Password

Anyone with the Base32 secret can generate every future code. Store it in a secrets manager, never in source control, and prefer test secrets here.

Keep Clocks in Sync

TOTP depends on accurate time. Enable network time sync on servers and devices so codes line up within the verification window.

Stick to the Defaults Unless Required

SHA-1, 6 digits, and a 30-second period maximize app compatibility. Only switch to 8 digits or SHA-256/512 when your provider mandates it.

TOTP / 2FA Generator FAQ